This message was deleted.
# puppet-enterprises
Slackbot
04/19/2023, 2:16 PMThis message was deleted.
c
csharpsteen
04/19/2023, 2:19 PMNo, those files need to be copied from the original server. Although, there's no real loss if SSH/WinRM credentials or a SAML integration is not in use.
b
bastelfreak
04/19/2023, 2:21 PMSSH/WinRM/SAML wasn't used, just AD integration (and we manage that with a puppet resource)
bastelfreak
04/19/2023, 2:30 PMwhat is the keys.json used for in the orchestrator/console-services directory?
bastelfreak
04/19/2023, 2:31 PMand the orchestrator-encryption-keys.json?
bastelfreak
04/19/2023, 2:33 PMc
csharpsteen
04/19/2023, 2:36 PMThe Orchestrator key provides encryption-at-rest for SSH private keys and WinRM passwords stored in Postgres.
b
bastelfreak
04/19/2023, 2:36 PMahh
c
csharpsteen
04/19/2023, 2:36 PMThe Console key does the same for the credentials used to bind with LDAP or integrate with SAML.
b
bastelfreak
04/19/2023, 2:38 PMwe can probably hack the script from https://www.puppet.com/docs/pe/2021.7/rotating_inventory_service_secret_key.html#rotating-inventory-service-secret-key and use it for the console-services as well?
c
csharpsteen
04/19/2023, 2:40 PMMaybe. Both services are using the same Postgres functionality, but the implementation paths might be different.
@jonathan.newman What's the best way to rotate or clear Console LDAP credentials if the encryption key was lost?
b
bastelfreak
04/19/2023, 2:49 PMand how is orchestrator-encryption-keys.json used? that's not updated by the script, just the keys.json
s
steveax
04/19/2023, 5:36 PMWhen the RBAC service starts up, if the encryption key is not present, it’ll just generate a new one. Then you can re-enter LDAP settings
b
bastelfreak
04/19/2023, 6:01 PMand if there are already LDAP settings in the DB? Will it generate a new a new key but unable to read existing settings in the DB? do we need to purge anything in the DB?
bastelfreak
04/19/2023, 6:02 PMwe were not able to configure the LDAP settings via the API, but I had no time to investigate today
s
steveax
04/19/2023, 6:07 PMYeah, it will not be able to read the stored creds - there will probably be some log entries around that. For replacing, you should be able to just
PUT /dssteveax
04/19/2023, 6:08 PMb
bastelfreak
04/19/2023, 6:08 PMmhm it probably failed because the puooet reaource first does a GET to check the current config
bastelfreak
04/19/2023, 6:08 PMwill give that a try tomorrow, thanks!
s
steveax
04/19/2023, 6:09 PM👍
b
bastelfreak
04/20/2023, 7:15 AMIt doesn't look like I can update the LDAP config when there is old data in the database that' encrypted with another key. console-services log says:
Copy code
2023-04-20T09:10:31.309+02:00 [qtp751524958-41576] WARN [p.r.h.middleware] PUT /rbac-api/v1/ds
org.postgresql.util.PSQLException: ERROR: Wrong key or corrupt datas
steveax
04/20/2023, 3:22 PMhmmm, did you try putting an empty object first to clear?
j
jonathan.newman
04/20/2023, 4:08 PMWhat version of PE is this? We might have to resort to direct DB manipulation to resolve it.
jonathan.newman
04/20/2023, 4:10 PMIn 2023.0, there is this new API: https://www.puppet.com/docs/pe/2023.0/rbac_api_v1_directory.html#rbac-api-v1-post-command-ldap-delete
b
bastelfreak
04/20/2023, 5:57 PMIt is 2021.7.2
bastelfreak
04/20/2023, 5:57 PM@steveax oh! We only tried to PUT a new config, not an empty one
bastelfreak
04/20/2023, 5:58 PMin the meantime someone found the old keys in a backup, so we are good now. but maybe it would be helpful to update the maintenance page that has orchestrator key rotation with console services recovery as well
👍 1
s
simonhoenscheid
04/20/2023, 8:31 PMI know it is intentional these keys are not part of a PE Backup. But an option like
--yesiwanttobackupsecrets👍 1
2 Views